Arbitrary Directory Deletion Vulnerability in Assistant for NextGEN Gallery Plugin by WordPress
CVE-2025-7641
7.5HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 15 August 2025
What is CVE-2025-7641?
The Assistant for NextGEN Gallery plugin for WordPress contains a critical vulnerability that allows unauthenticated attackers to delete arbitrary directories on the server. This is due to inadequate validation of file paths within the /wp-json/nextgenassistant/v1.0.0/control REST endpoint, affecting all versions up to and including 1.0.9. Exploiting this vulnerability could lead to significant disruptions and could jeopardize the availability of the affected server.
Affected Version(s)
Assistant for NextGEN Gallery * <= 1.0.9